introduction to game theory moore tandy school of computer science, university of tulsa ... more...

Introduction to Game Theory

Tyler Moore

Tandy School of Computer Science, University of TulsaSlides are modified from version written by Benjamin Johnson, UC Berkeley

Lecture 15–16

Outline

1 Review: rational choice modelPreferences and outcomesUtilityExpected utility: modeling security threats as random acts

2 Game theoryIntroduction and notationFinding equilibrium outcomes

2 / 41

Topics

We now discuss the final big idea in the course

1 Introduction

2 Security metrics and investment

3 Measuring cybercrime

4 Security games

We now consider strategic interaction between players

3 / 41

Review: rational choice model Preferences and outcomes

Recall how we model rationality

Economics attempts to model the decisions we make, when facedwith multiple choices and when interacting with other strategic agents

Rational choice theory (RCT): model for decision-making

Game theory (GT): extends RCT to model strategic interactions

5 / 41

Notes

Notes

Notes

Notes


Model of preferences

An agent is faced with a range of possible outcomes o1, o2 ∈ O, theset of all possible outcomes

Notation

o1 � o2: the agent is strictly prefers o1 to o2.o1 � o2: the agent weakly prefers o1 to o2;o1 ∼ o2: the agent is indifferent between o1 and o2;

Outcomes can be also viewed as tuples of different propertiesx , y ∈ O, where x = (x1, x2, . . . , xn) and y = (y1, y2, . . . , yn)

6 / 41


Rational choice axioms

Rational choice theory assumes consistency in how outcomes are preferred.

Axiom

Completeness. For each pair of outcomes o1 and o2, exactly one of thefollowing holds: o1 � o2, o1 ∼ o2, or o2 � o1.

⇒ Outcomes can always be compared

Axiom

Transitivity. For each triple of outcomes o1, o2, and o3, if o1 � o2 ando2 � o3, then o1 � o3.

⇒ People make choices among many different outcomes in a consistentmanner

7 / 41

Review: rational choice model Utility

Utility

Rational choice theory defines utility as a way of quantifying consumerpreferences

Definition

(Utility function) A utility function U maps a set of outcomes ontoreal-valued numbers, that is, U : O → R. U is defined such thatU(o1) > U(o2) ⇐⇒ o1 � o2 .

Agents make a rational decision by picking the outcome with highestutility:

o∗ = arg maxo∈O

U(o) (1)

8 / 41

Review: rational choice model Expected utility: modeling security threats as random acts

Why isn’t utility theory enough?

Only rarely do actions people take directly determine outcomes

Instead there is uncertainty about which outcome will come to pass

More realistic model: agent selects action a from set of all possibleactions A, and then outcomes O are associated with probabilitydistribution

9 / 41

Notes

Notes

Notes

Notes


Expected utility

Definition

(Expected utility (discrete)) The expected utility of an action a ∈ A isdefined by adding up the utility for all outcomes weighed by theirprobability of occurrence:

E [U(a)] =∑o∈O

U(o) · P(o|a) (2)

Agents make a rational decision by maximizing expected utility:

a∗ = arg maxa∈A

E [U(a)] (3)

10 / 41


Example: process control system security

Source: http://www.cl.cam.ac.uk/~fms27/papers/2011-Leverett-industrial.pdf11 / 41



Actions available: A = {disconnect, connect}Outcomes available: O = {successful attack,no successful attack}Probability of successful attack is 0.01 (P(attack|connect) = 0.01)

If systems are disconnected, then P(attack|disconnect) = 0

12 / 41



successful attack no succ. attackAction U P(attack|action) U P(no attack|action) E [U(action)]

connect -50 0.01 10 0.99 9.4disconnect -10 0 -10 1 -10

⇒ risk-neutral IT security manager chooses to connect sinceE [U(connect)] > E [U(disconnect)].

This model assumes fixed probabilities for attack. Is this assumptionrealistic?

13 / 41

Notes

Notes

Notes

Notes

http://www.cl.cam.ac.uk/~fms27/papers/2011-Leverett-industrial.pdf

Game theory Introduction and notation

Games vs. Optimization

Optimization: Player vs Nature

Games: Player vs Player

15 / 41


Strategy

Book of Qi

War

Business

Policy

36 Stratagems (Examples)

Befriend a distant state while attacking a neighbor

Sacrifice the plum tree to preserve the peach tree

Feign madness but keep your balance

See http://en.wikipedia.org/wiki/Thirty-Six_Stratagems

16 / 41


Representing a game with a payoff matrix

Suppose we have two players A and B.

A’s actions AA = {u, d}B’s actions AB = {l , r}Possible outcomes O = {(u, l), (u, r), (d , l), (d , r)}We represent 2-player, 2-strategy games with a payoff matrix

Player B Player Bchooses l chooses r

Player A chooses u (UA(u, l),UB(u, l)) (UA(u, r),UB(u, r))Player A chooses d (UA(d , l),UB(d , l)) (UA(d , r),UB(d , r))

17 / 41


Returning to the process control system example

Suppose we have two players: plant security manager and a terrorist

Manager’s actions Amgr = {disconnect, connect}Terrorist’s actions Aterr = {attack,don’t attack}Possible outcomes O = {(a1, a3), (a1, a4), (a2, a3), (a2, a4)}We represent 2-player, 2-strategy games with a payoff matrix

Terroristattack don’t attack

Manager connect (−50, 50) (10, 0)disconnect (−10,−10) (−10, 0)

18 / 41

Notes

Notes

Notes

Notes

http://en.wikipedia.org/wiki/Thirty-Six_Stratagems


Important Notions

Zero-Sum

In a zero-sum game, the sum of player utilities is zero.

zero-sum not zero-sumheads tails

heads (1,−1) (−1, 1)tails (−1, 1) (1,−1)

invest defer

invest (1, 1) (1, 2)defer (2, 1) (0, 0)

19 / 41

Game theory Finding equilibrium outcomes

How can we determine which outcome will happen?

We look for particular solution concepts1 Dominant strategy equilibrium2 Nash equilibrium

Pareto optimal outcomes

20 / 41


Dominant strategy equilibrium

A player has a dominant strategy if that strategy achieves the highestpayoff regardless of what other players do.

A dominant strategy equilibrium is one in which each player has andplays her dominant strategy.

Example 1: Dominant Strategy Equilibria?

yes: (down, left)

Bobleft right

Alice up (1, 2) (0, 1)down (2, 1) (1, 0)

21 / 41


Nash equilibrium

Nash equilibrium

A Nash equilibrium is an assignment of strategies to players such that noplayer can improve her utility by changing strategies.

A Nash equilibrium is called strong if every player strictly prefers theirstrategy given the current configuration.

It is called weak if at least one player is indifferent about changingstrategies.

Nash equilibrium for 2-player game

For a 2-person game between players A and B, a pair of strategies (ai , aj)is a Nash equilibrium if UA(ai , aj) ≥ UtilityA(ai ′ , aj) for every i ′ ∈ AA

where i ′ 6= i and UB(ai , aj) ≥ UB(ai , aj ′) for every j ∈ AB where j ′ 6= j .

22 / 41

Notes

Notes

Notes

Notes


Finding Nash equilibria

Nash equilibrium for 2-player game

For a 2-person game between players A and B, a pair of strategies (ai , aj)is a Nash equilibrium if UA(ai , aj) ≥ UA(ai ′ , aj) for every i ′ ∈ AA wherei ′ 6= i and UB(ai , aj) ≥ UB(ai , aj ′) for every j ∈ AB where j ′ 6= j .

Example 1: Nash equilibria? (up,left) and (down, right)

Bobleft right

Alice up (2, 1) (0, 0)down (0, 0) (1, 2)

(up,left)?: UA(up, left) > UA(down, left)?2 > 0 ? yes!UB(up, left) > UB(up, right)?1 > 0 ? yes!

(up,right)?: UA(up, right) > UA(down, right)?0 > 1 ? no!UB(up, right) > UB(up, left)?0 > 1 ? no!

23 / 41

Exercise: is there a dominant strategy or Nash equilibriumfor these games?

Nash: (down,left) and (up,right) No Nash equilibrium

left right

up (1, 1) (1, 2)down (2, 1) (0, 0)

left right

up (1,−1) (−1, 1)down (−1, 1) (1,−1)


Pareto Optimality

Definition

An outcome of a game is Pareto optimal if no other outcome makes atleast one player strictly better off, while leaving every player at least aswell off.

Example: Pareto-optimal outcome? everything except defect/defect

cooperate defect

cooperate (−1,−1) (−5, 0)defect (0,−5) (−2,−2)

25 / 41


Prisoners’ dilemma

deny confess

deny (−1,−1) (−5, 0)confess (0,−5) (−2,−2)

26 / 41

Notes

Notes

Notes

Notes


Thoughts on the Prisoners’ Dilemma

Can you see why the equilibrium strategy is not always Paretoefficient?

Exemplifies the difficulty of cooperation when players can’t commit toa actions in advance

In a repeated game, cooperation can emerge because anticipatedfuture benefits shift rewards

But we are studying one-shot games, where there is no anticipatedfuture benefit

Here’s one way to use psychology to commit to a strategy:http://www.tutor2u.net/blog/index.php/economics/

comments/game-show-game-theory

27 / 41


Split or Steal

Nicksplit steal

Ibrahim split (6 800, 6 800) (0, 13 600)steal (13 600, 0) (0, 0)

28 / 41


Prisoners’ dilemma in infosec: sharing security data

share don’t share

share (−1,−1) (−5, 0)don’t share (0,−5) (−2,−2)

Note, this only applies when both parties are of the same type, and can benefit each other from

sharing. Doesn’t apply in the case of take-down companies due to the outsourcing of security

29 / 41


Assurance games: Cold war arms race

USSRrefrain build

USA refrain (4,4) (1,3)build (3,1) (2,2)

Exercise: compute the equilibrium outcome (Nash or dominant strategy)

30 / 41

Notes

Notes

Notes

Notes

http://www.tutor2u.net/blog/index.php/economics/comments/game-show-game-theory

http://www.tutor2u.net/blog/index.php/economics/comments/game-show-game-theory


Assurance games in infosec: Cyber arms race

Russiarefrain build


31 / 41


Assurance games in infosec: Upgrading protocols

Many security protocols (e.g., DNSSEC, BGPSEC) require widespread

adoption to be usefulupgrade don’t upgrade

upgrade (4,4) (1,3)don’t upgrade (3,1) (2,2)

32 / 41


Battle of the sexes

party home

party (10, 5) (0, 0)home (0, 0) (5, 10)

33 / 41


Stag-hunt games and infosec: joint cybercrime defense

Stag hunt Coordinating malware responsestag hare

stag (10, 10) (0, 7)hare (7, 0) (7, 7)

join WG protect firm

join WG (10, 10) (0, 7)protect firm (7, 0) (7, 7)

34 / 41

Notes

Notes

Notes

Notes


Chicken

dare chicken

dare (0, 0) (7, 2)chicken (2, 7) (5, 5)

35 / 41


Chicken in infosec: who pays for malware cleanup?

ISPsPay up Don’t pay

Gov Pay up (0, 0) (−1, 1)Don’t pay (1,−1) (−2,−2)

36 / 41


How to coordinate (Varian, Intermediate Microeconomics)

Goals of coordination game: force the other player to cooperate

Assurance game: “coordinate at an equilibrium that you both like”Stag-hunt game: “coordinate at an equilibrium that you both like”Battle of the sexes: “coordinate at an equilibrium that one of youlikes”Prisoner’s dilemma: “play something other than an equilibriumstrategy”Chicken: “make a choice leading to your preferred outcome”

37 / 41


How to coordinate (Varian, Intermediate Microeconomics)

In assurance, stag-hunt, battle-of-the-sexes, and chicken, coordinationcan be achieved by one player moving first

In prisoner’s dilemma, that doesn’t work? Why not?

Instead, for prisoner’s dilemma games one must use repetition orcontracts.

Robert Axelrod ran repeated game tournaments where he invitedeconomists to submit strategies for prisoner’s dilemma in repeatedgames

Winning strategy? Tit-for-tat

38 / 41

Notes

Notes

Notes

Notes


Assurance games: Cyber arms race

Russiarefrain build


39 / 41


Russia proposed a cyberwar peace treaty

40 / 41


US Department of Homeland Security signals support forDNSSEC

Source: https://www.dnssec-deployment.org/index.php/2011/11/dhs-wins-national-cybersecurity-award-for-dnssec-work/

41 / 41

Notes

Notes

Notes

Notes

https://www.dnssec-deployment.org/index.php/2011/11/dhs-wins-national-cybersecurity-award-for-dnssec-work/

introduction to game theory moore tandy school of computer science, university of tulsa ... more...

Documents